Starstruk Logo MarkStarstruk

v4.6.5

honojs/honov4.6.5Oct 15, 2024by yusukebe

AI Summary

This release addresses a critical security vulnerability in the CSRF Protection Middleware where requests without a Content-Type header could bypass protection. It also includes performance improvements to type handling, a CORS fix to prevent incorrect Access-Control-Allow-Origin headers, and a new optional server name feature for the powered-by header.

Key Highlights

  • Security fix for CSRF Protection Middleware - blocks requests without Content-Type header that could bypass protection (GHSA-2234-fmw7-43wr)
  • Performance improvement: replaced intersection with union for better type performance
  • Type fix: removed ExcludeEmptyObject to fix massively increased type instantiations
  • CORS fix: avoid setting Access-Control-Allow-Origin header when no origin matches
  • New feature: optional server name for powered-by header

New Features

  • Optional server name for powered-by header - allows setting custom server identification in responses

Full Release Notes

## Security fix for CSRF Protection Middleware

This release includes a security fix for CSRF Protection Middleware. If you are using CSRF Protection Middleware, please upgrade this `hono` package immediately.

Before this release, a request without a `Content-Type` header can bypass the protection. This fix does not allow it. See: https://github.com/honojs/hono/security/advisories/GHSA-2234-fmw7-43wr

## What's Changed
* perf(types): replace intersection with union to get better perf by @m-shaka in https://github.com/honojs/hono/pull/3443
* ci: use Deno `v2` by @yusukebe in https://github.com/honojs/hono/pull/3506
* ci: use Deno v2 for a test running for deno by @nakasyou in https://github.com/honojs/hono/pull/3509
* fix(types): rm ExcludeEmptyObject to fix massively increased type instantiations by @m-shaka in https://github.com/honojs/hono/pull/3507
* fix(cors): avoid setting `Access-Control-Allow-Origin` if there is no matching origin by @uki00a in https://github.com/honojs/hono/pull/3510
* feat(powered-by): optional server name by @PatrickJS in https://github.com/honojs/hono/pull/3492
* fix(factory): revert PR #3498 by @yusukebe in https://github.com/honojs/hono/pull/3515
* fix(build): remove private fields by @nakasyou in https://github.com/honojs/hono/pull/3514

## New Contributors
* @uki00a made their first contribution in https://github.com/honojs/hono/pull/3510
* @PatrickJS made their first contribution in https://github.com/honojs/hono/pull/3492

**Full Changelog**: https://github.com/honojs/hono/compare/v4.6.4...v4.6.5